Guide
Cyber Essentials vs Cyber Essentials Plus: which one, what cost
Updated
Both levels assess the same five technical controls. The difference is verification: Cyber Essentials takes your word for it, formally; Cyber Essentials Plus sends an auditor to test it. Contracts usually decide which you need.
The two levels
- Cyber Essentials (self-assessment)
- You complete the official question set about your organisation's implementation of the five controls; a board member or equivalent signs it off, and a licensed assessor reviews the answers. Priced by size at £320–£600 +VAT under IASME's published tiers (verify current). Most organisations can complete it within days once the controls are actually in place.
- Cyber Essentials Plus (audited)
- Everything in the self-assessment, plus a hands-on technical audit: an assessor tests a sample of your devices and systems, including vulnerability scans and checks of email and browser malware defences. Quoted by certification bodies, typically £1,400–£2,500 +VAT for a small organisation (typical 2026 quotes), on top of the self-assessment fee.
Timing matters: a Cyber Essentials Plus assessment must follow a completed Cyber Essentials self-assessment within a set window (three months under current scheme rules; confirm with your certification body when booking). Book both together if you know you need Plus.
Which one do you need?
- The contract decides. UK central government procurement policy has required Cyber Essentials for contracts involving certain personal and sensitive data handling since 2014 (Procurement Policy Note 09/14), and many Ministry of Defence contracts require certification through the MoD's supplier cyber requirements. Some specify Plus; read the exact wording.
- Customers and insurers increasingly ask, and some accept only Plus because it is independently tested rather than self-declared.
- No external driver? Start with the self-assessment: it is the cheap, fast way to force the five controls into place, and you can add Plus later if a contract demands it.
Cost comparison
| Item | Cyber Essentials | Cyber Essentials Plus |
|---|---|---|
| Scheme fee | £320–£600 +VAT (published tiers, verify current) | Self-assessment fee plus audit quote |
| Audit | None: assessor-reviewed self-assessment | £1,400–£2,500+ +VAT typical (2026 quotes) |
| Typical all-in, 10–49 staff | £440 +VAT | £1,800–£3,000 +VAT |
| Renewal | Annually, same structure | Annually, same structure |
The Plus audit price moves with the size of the device sample, the number of locations and whether testing is remote or on site, which is why quotes for the same organisation can differ meaningfully between certification bodies. Get more than one, via the form, before booking.